A New Rank Metric Codes Based Encryption Scheme

Abstract

To cite this version:Pierre Loidreau. A new rank metric codes based encryption scheme. PQCrypto 2017, Jun 2017 A new rank metric codes based encryption scheme Pierre LoidreauDGA MI and Université de Rennes 1Abstract. We design a new McEliece-like rank metric based encryption scheme from Gabidulin codes. We explain why it is not affected by the invariant subspace attacks also known as Overbeck's attacks. The idea of the design mixes two existing approaches designing rank metric based encryption schemes. For a given security our public-keys are more compact than for the same security in the Hamming metric based settings.

A New Algorithm for Solving the Rank Syndrome Decoding Problem

“…In this section, we present two public key encryption cryptosystems: the Loidreau cryptosystem [3] (based on Gabidulin codes masked by an LRPC matrix) and the LRPC cryptosystem [2]. Some of their parameters are broken by our attack.…”

“…In our case, the norm of a vector over Fqm is defined by the dimension of the Fq-subspace generated by its coordinates. This problem is very similar to the Syndrome Decoding problem in the Hamming metric (only the metric and the field of the coefficients are different) and the security of several cryptosystems relies on its hardness, like McEliece-based PKE [2], [3] or IBE [4]. Our attack is in O (n − k) 3 [1], [5].…”

“…This problem is very similar to the Syndrome Decoding problem in the Hamming metric (only the metric and the field of the coefficients are different) and the security of several cryptosystems relies on its hardness, like McEliece-based PKE [2], [3] or IBE [4]. Our attack is in O (n − k) 3 [1], [5]. In particular in the case m ≤ n, our attack permits to obtain an exponential gain in q m(1−R) for R = k/n the rate of the code.…”

Improved Veron Identification and Signature Schemes in the Rank Metric

“…We choose the values m, n, k, r accordingly. As far as it concerns post-quantum security, the author of [29], in line with [12], presents some arguments showing that the post-quantum complexity of RSD is computed by square-rooting the exponential term in the classical complexity formula.…”

“…We also add the results from [7] regarding the Hamming variants of Stern, Veron and CVE signature schemes, one entry for the parameters proposed in [5] for the double circulant version of Veron scheme in the Hamming metric, and one entry for the parameters proposed in [23] for the rank version of Stern signature scheme. As far as it concerns the latter, we remark that when the work was published, results from [21], [8], and [29] were not known, so the security was believed to be 83 bits. While for the parameters in [5], according the decoding complexity estimation of 2 0.097n given in [31], the security of the scheme is about 68 bits, while in [5] was claimed to be 81.…”